Phishing Email Examples and How to Spot Them

A phishing email is a fraudulent message designed to trick you into revealing login credentials, financial details or sensitive business data, or into sending money. These emails often masquerade as banks, vendors, government agencies or colleagues.

Some are broad and generic. Others are targeted: spear phishing uses details about you or your company, and business email compromise (covered below) impersonates a specific executive or vendor. Similar tricks also arrive by text message, phone call and QR code.

One successful attack can lead to data breaches, ransomware, financial loss, regulatory fines and damage to your reputation. The latest figures show the scale:

• Breaches are expensive. IBM’s 2026 report puts the global average cost at $4.99 million and the U.S. average at $11.5 million (IBM).
• Email fraud costs billions. The FBI received reports of about $20.9 billion in internet crime losses in 2025, and business email compromise ranked second among crime types at about $3 billion (FBI IC3).
• Small businesses are targeted. About 96% of ransomware victims with a known size in Verizon’s 2026 report were small or mid-sized businesses (Verizon DBIR 2026).

Phishing is one of several ways in. Verizon found exploited software vulnerabilities were the most common known entry point at 31%, ahead of stolen credentials at 13%, which is why patching and MFA matter alongside training.

1. Look-alike sender addresses and domains

Attackers register addresses that differ by a letter or character, such as support@paypall.com instead of support@paypal.com. The display name can say anything, so check the actual address behind it.

2. Urgent or threatening language

“Your account will be suspended” and “Immediate action required” are designed to make you act before you think.

3. Unexpected requests for money, gift cards, payroll or bank changes

Any message that asks for payment, gift cards, new banking details or a payroll change deserves a second look, even when it appears to come from someone you know.

4. Unexpected attachments and links

Hover over a link (or press and hold on a phone) to see where it really goes. If the address does not match the supposed sender, do not click.

5. Fake login pages

Many phishing links lead to a convincing sign-in page that captures your password. Open the site yourself or use a bookmark instead of signing in from an email link.

6. QR codes in emails

A QR code moves the attack to your phone, where filters cannot see it. Treat an unexpected QR code like an unexpected link.

7. Impersonated executives and hijacked threads

A message that appears to come from your CEO or a trusted vendor, sometimes inside a real email thread, asking for something new such as changed bank details, should be verified by phone before you act.

8. Odd wording, generic greetings or off-brand design

These can still give a scam away, but they are no longer reliable on their own. A polished, personal email can be just as dangerous.

Red flags:

• Look-alike domain: “vend0r” uses a zero instead of an o
• Urgency and a threat of penalties
• Unexpected compressed attachment
• No invoice details or contact information

Red flags:

• Domain impersonation: “m1crosoft” is not Microsoft
• Fear-inducing message
• The link goes to a non-Microsoft site
• Asks you to sign in from an email link, not from the real website

Red flags:

• The display name looks internal, but the address is free webmail
• A payroll deadline creates pressure
• Requests banking details through a link
• HR can confirm a change in person or by phone, so verify that way

Red flags:

• An executive’s name paired with a personal email address
• Secrecy and urgency, plus a reason they cannot talk by phone
• Gift cards are an unusual payment method
• A request out of the ordinary for that person

Red flags:

• The domain is not Microsoft’s
• A generic message with no personal note
• The link leads to a fake sign-in page that steals your password
• You were not expecting the file

Red flags:

• QR codes hide the destination and slip past email link scanning
• A same-day deadline
• An outside domain posing as IT
• It moves you to your phone, where protections are weaker

Do not panic or hide it. Speed matters far more than embarrassment. Take these steps in order:

1. Disconnect. Turn off Wi-Fi or unplug the network cable on the device you used.
2. Tell IT right away. Report it to your IT team or provider so they can check the device and warn others.
3. Change your passwords. If you entered a password, change it from a different, clean device, and change any account that reused it. Turn on MFA.
4. Have the device scanned. If you opened an attachment, your IT team should scan it or check it with endpoint detection and response (EDR) tools.
5. Contact your bank if money was involved. Ask them to stop or recall the transfer, then report it to the FBI’s Internet Crime Complaint Center at ic3.gov.
6. Watch for follow-up activity. Look for unfamiliar sign-ins, new email forwarding rules and messages sent from your account.
7. Report the email. Use your email’s “Report phishing” option so filters learn from it.

If you only suspect an email and have not clicked, do not open anything. Verify the sender through a channel you trust, report it and delete it.

Business email compromise is a targeted fraud in which an attacker impersonates an executive, employee or vendor, or takes over a real mailbox, to trick someone into sending money or changing payment details. It often involves no malicious link or attachment, so filters struggle to catch it, and the losses are far larger than most ordinary phishing.

The best defenses are procedural: confirm every change to bank details by phone using a number you already have, require two approvals for payments, and keep MFA on every mailbox.

No single tool stops every scam, so we recommend layers.

Security awareness training and simulations

Regular training and simulated phishing emails build the habit of pausing before clicking. See our guides on user training and the human firewall.

Email filtering and authentication

Advanced filters catch much of the threat, especially those with AI-based detection. Ask your IT provider to set up SPF, DKIM and DMARC so criminals cannot easily spoof your domain.

Multi-factor authentication (MFA)

Even if a password is stolen, MFA can stop the attacker from using it.

Endpoint protection and updates

Deploy antivirus and EDR on every device and patch promptly, since attackers also exploit outdated software.

A payment verification policy

Require a call-back before any change to payment details, and a second approval for large transfers.

To see where you stand, run our 5-minute cyber security checklist, or read what cybersecurity is and how businesses protect themselves.

We provide practical, layered protection tailored to small and growing businesses, including employee phishing awareness training, email security solutions, managed detection and response, threat intelligence and incident response planning. We help you stop phishing attacks before they cause harm.

A phishing attack is a form of online fraud in which criminals pose as trusted people or organizations to trick you into sharing sensitive information, sending money or clicking harmful links. Most arrive by email, but text messages, phone calls and QR codes are also used.

Common examples include fake invoices, “security alert” messages that mimic Microsoft or Google, payroll and direct deposit change requests, executive gift card requests, fake shared-document notices and QR code “MFA update” emails. Six are shown above with the red flags marked.

Check the actual sender address, question urgent or unusual requests (especially for money, gift cards or banking changes), hover over links before clicking, and be wary of unexpected attachments or QR codes. Do not rely on typos or generic greetings, since AI-written scams are often flawless.

Yes, but the clues have shifted from spelling to context. Look at who is really sending the message, whether the request is unusual, and where the links lead. When money or credentials are involved, verify by phone using a number you already trust.

Disconnect the device from the network, tell your IT team or provider right away, and change any password you entered from a different, clean device. Turn on multi-factor authentication, check for unusual account activity, and contact your bank immediately if money or banking details were involved.

Phishing casts a wide net with fake messages. Business email compromise (BEC) is a targeted scam in which an attacker impersonates an executive, employee or vendor to trick someone into sending money or changing payment details, often without any malicious link at all.

Yes. Even advanced filters can miss targeted or well-crafted scams, which is why trained employees and layered security tools both matter.

We provide employee phishing awareness training, email security and threat detection, managed monitoring and incident response planning, so your team and your systems are both prepared.